Ransomware Detection via File Comparison and Entropy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern ransomware variants encrypt files in ways that make detection difficult using traditional methods, posing challenges in early detection and remediation.
Innovation Solution
An anti-malware application monitors processes on a computing device, saves a portion of an original file before editing, and compares it to the edited file to determine encryption, generating a score based on indicators to identify and remediate ransomware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional encryption detection methods are used, then detection simplicity is maintained, but detection accuracy deteriorates against modern ransomware variants
Solution Approach 1:
The patent segments the file comparison process into multiple analysis dimensions: byte-level comparison, entropy analysis, and statistical pattern recognition. By dividing the detection task into these separate analytical components, the system achieves comprehensive detection accuracy without requiring a single overly complex detection mechanism. Each segment handles specific aspects of encryption detection, collectively resolving the contradiction between simplicity and accuracy.
Solution Approach 2:
The patent transforms the detection approach by changing multiple parameters simultaneously: comparing byte distributions, analyzing entropy values, and examining statistical patterns rather than relying on traditional signature-based detection. This multi-parameter analysis enables accurate detection of modern ransomware variants that obfuscate their encryption methods, while maintaining a systematic framework that manages complexity through structured parameter evaluation.
2Reliability
If file comparison analysis is performed, then false positives are reduced, but processing time increases
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing baseline statistical parameters for normal file operations. When a file operation is monitored, the system compares it against these pre-established patterns rather than performing complete analysis from scratch. This preliminary preparation significantly reduces processing time during actual detection while maintaining high reliability through comprehensive comparison criteria.
Solution Approach 2:
The patent implements partial action by analyzing only the most discriminative features of file operations rather than performing exhaustive analysis of all file attributes. The system focuses on key indicators such as byte distribution patterns and entropy changes that are most indicative of encryption, performing sufficient analysis to achieve high detection reliability while avoiding unnecessary processing of less relevant file characteristics, thus reducing overall processing time.
Data Source
AI summary
An anti-malware application detects and remediates ransomware. The anti-malware application monitors processes executing on a computing device and detects that a process is opening a file for editing. A portion of the original file is saved prior to being edited by the process. Once the edited file is saved, the anti-malware application compares a portion of the edited file to the portion of the original file to determine if the edited file is encrypted. The anti-malware application may determine the process is associated with ransomware based on whether the edited file is encrypted.